AI agent for mobile reverse engineering.

Automated cryptographic analysis, runtime tracing, and SSL pinning bypass for Android applications. Local-first security research toolkit with your choice of AI provider.

Windows x64 · One computer · No payment details

AndroidCrypto replicationRuntime tracingPlanning modeSSL pinningAnti-debugAnti-tamperWorkspace artifactsLocal workspacesBYOK

002 — Specialty

Morrigan is built for security researchers who have already lived inside IDA, Frida, and JADX — and want their slow work done in hours.

003 — Selected features

Crypto replication, traced and validated.

01 / Crown jewelCrypto replication

// hooked javax.crypto.Cipher.doFinal
→ input  b"5c 8a 91 ff 02 18 …"
→ output b"3a 7e 9c 22 4d a1 …"
// 12 vectors collected
→ python crypto.py
→ validate vs runtime  PASS · 12/12

From bytecode to a working Python module.

Static search finds the candidate routines. Runtime tracing collects inputs and outputs. The agent writes a Python replica and compares it against the captured test vectors. Review the evidence and validate the result against your target.

02 / Research workflowPlanning mode

// proposed plan, 4 steps
1. apktool d target.apk
2. jadx-cli — sources/
3. frida -U -f com.target.app
4. collect → crypto.py

→ approve · edit · cancel

Keep your next step inspectable.

Work through a research plan, inspect generated commands and hooks, and review tool activity in the workspace. Choose your targets and review active operations before relying on the results.

03 / Local-firstPrivacy model

// research and service boundaries
workspace         local artifacts
AI context        your provider
website account   Vendor
license & devices Licensing

→ bring your own API key
→ review what you share

Your workspace. Your provider.

Research artifacts stay in your local workspace. AI requests send relevant context to the provider you configure. Website accounts and licensing have their own service records, explained in the privacy notice.

04 / WorkspaceArtifacts

~/.morrigan/projects/com.target/
├── apk/           target.apk + splits
├── decompiled/    jadx + apktool out
├── hooks/         12 frida scripts
├── traces/        128 captures
├── crypto.py      validated module
├── plan.md
└── session.md     markdown report

Every artifact stays on disk, yours to edit.

Generated Frida scripts and Python modules are inspectable, version-controllable, and reusable across projects.

004 — Beta access

From your first sign-in to your first investigation.

Windows beta
Seven-day free trial · One computer · BYOK

01Create your account — verify your email.Your trial starts here

02Save your key, shown once.Keep it somewhere safe

03Download and activate Morrigan.Windows x64

04Connect your AI provider.Provider usage billed separately

05Open a workspace. Follow the evidence.Your research starts here

005 — Capabilities

A toolchain you already trust, driven by the agent.

A · Static analysis

Decompile, index, search.

Bundled apktool + JADX, driven by the agent. Static search for crypto usage, network-stack indicators, and basic protection markers.

B · Runtime tracing

Hooks, generated on demand.

Bundled hook template library + dynamic generation. Spawn or attach. Crash recovery built in. Captures fed straight to the replication pipeline.

C · Crypto replication

A Python module, validated.

Inputs and outputs collected at runtime become test vectors. Work toward a Python replica and compare its behavior with the target.

D · SSL pinning

Authorized bypass assistance.

Generated hooks for the common pin-check patterns. For authorized testing only. Inspectable, editable, in your workspace.

E · Session memory

Plans, traces, reports.

Workspace artifacts persist across sessions. Markdown reports summarise what the agent did, what worked, and what it parked for review.

F · Research workflow

Inspect the work as it happens.

Review tool activity, generated scripts and research artifacts. Keep the investigation within your authorized scope and independently validate the findings.

Replicate Android crypto. Locally.

006 — Get access